feat(builder): merge deb-publisher + publish-docker-image into contract-driven builder skill

- skills/builder: SKILL.md, README.md, references/contract.md (make/publish
  contract v1), references/registry.md
- scripts/check.py: executable contract checker (make dry-run probes, secret
  scan, push thin-wrapper and script path checks; --build verifies real .deb)
- scripts/upload_deb.sh: migrated from deb-publisher, adds project .env
  auto-load and dirty-worktree publish gate
- scripts/publish_docker.sh: migrated from publish-docker-image publish.sh,
  now env-first (DOCKER_REGISTRY/REPOSITORY/IMAGE_TAG/PLATFORMS), refuses
  floating latest and multi-platform --load
- scripts/verify_deb.sh: metadata/content/sha256 verification with v-prefix
  normalization
- orc: deb+docker stages both route to $builder; routing table, DAGs,
  README, config untouched stage names; tests updated
- ack delivery.md + skiff source-model.md: reference builder
- remove skills/deb-publisher and skills/publish-docker-image

skills/orc/SKILL.md

@@ -73,8 +73,8 @@ JSON-compatible YAML，并由隔离的 Python 标准库解析。它固定包含
    `cursor-agent`。身份不明确时停止，不从用户任务文本、默认值或已安装 executable 猜测。
    确认宿主 CLI 可用；在 Cursor 中还要用 `cursor-agent --list-models`
    核对精确模型 ID 对当前账号可见。
-4. 确认本次所需下游 Skill 已安装：`ack`、`manage-release`、`deb-publisher`、
-   `publish-docker-image`。只检查实际会用到的项。
+4. 确认本次所需下游 Skill 已安装：`ack`、`manage-release`、`builder`。只检查实际
+   会用到的项；`deb` 与 `docker` 阶段都由 `$builder` 承载。
 5. 解析 profile 时把项目根和目标 worktree 一并交给 resolver；只有 resolver 验证目标是
    当前 Git 仓库已注册的 worktree 且身份稳定后才可创建终端。不得只做文本比较或跳过
    机器校验。
@@ -132,8 +132,8 @@ JSON-compatible YAML，并由隔离的 Python 标准库解析。它固定包含
 - 功能、缺陷、重构与验证闭环交给 `$ack`。
 - 发布版本、release 分支/PR/MR、合并、tag 与 Forge Release 交给
   `$manage-release`。
-- DEB 构建或上传交给 `$deb-publisher`。
-- Docker/OCI 镜像构建或上传交给 `$publish-docker-image`。
+- DEB 构建或上传交给 `$builder`（deb 阶段）；Docker/OCI 镜像构建或上传也交给
+  `$builder`（docker 阶段）。
 - 普通非发布 PR/MR 不伪装成版本发布；只有 ACK 已验证交付或明确的 release 流程才
   进入对应下游能力。